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Abstract — This paper presents a comprehensive analysis on 
the security of the Yi-Tan-Siew chaotic cipher proposed in [1]. 
A differential chosen-plaintext attack and a differential chosen- 
ciphertext attack are suggested to break the sub-key K, under the 
assumption that the time stamp can be altered by the attacker, 
which is reasonable in such attacks. Also, some security Problems 
about the sub-keys a and P are clarified, from both theoretical 
and experimental points of view. Further analysis shows that the 
security of this cipher is independent of the use of the chaotic tent 
map, once the sub-key K is removed via the proposed suggested 
differential chosen-plaintext attack. 

Index Terms — chaotic cryptography, tent map, differential 
cryptanalysis, chosen-plaintext attack, chosen-ciphertext attack. 



I. Introduction 

SINCE the 1990s, chaotic cryptography has attracted more 
and more attention as a promising way to design novel 
ciphers, and this research has become more intensive in recent 
years [2, Chap. 2]. To evaluate the security performance 
of chaotic ciphers and to clarify some design principles, 
cryptanalysis plays an important role. 

This paper analyzes the security of the recently-proposed 
Yi-Tan-Siew chaotic cipher [1] and points out some defects 
existing in this cipher: 

1) the sub-key K can be removed by a differential chosen- 
plaintext attack and a differential chosen-ciphertext at- 
tack, under the assumption that the time-stamp t can be 
altered by the attacker; 

2) the sub-key j3 should not be contained in the secret key 
due to its poor contribution to the security of the cipher; 

3) the noise vectors {Uj} used in the encryption/decryption 
functions do not have a uniform distribution, which 
downgrades the security of the cipher by limiting the 
value of the sub-key a; 

4) when the aforementioned differential chosen-plaintext 
(or chosen-ciphertext) attack is used, the security of the 
cipher is independent of the chaotic map, but depends on 
the mixture of three operations from different algebraic 
groups. 

The first two defects mean that the claimed key (a, /3, 7, K) 
collapses to be (a, 7). Note that the second and third defects 
were implicitly mentioned in Sec. III-B of [1] without con- 
vincing explanations. This paper will give a comprehensive 
analysis on all the four security defects. 
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The rest of this paper is organized as follows. The next 
section gives a brief introduction to the Yi-Tan-Siew chaotic 
cipher. Then, the first two defects of the cipher are discussed 
in SecHn] The other two defects are analyzed in Sees. IIVI and 
|yj respectively. The last section concludes the paper. 

II. Yi-Tan-Siew Chaotic Cipher 

This proposed cipher is a time-variant block cipher based 
on the chaotic tent map. Each block has 4n bits, and the 
encryption function changes as the iteration evolves. Given 
a plaintext P = {Pi, ■ ■ ■ ,Pj,--- , Pr) and the corresponding 



ciphertext C = (Ci 



3 ' 



,Cr), 



where Pj and Cj 



are 



both 4rt-bit blocks, the cipher is described as follows. 

• The employed chaotic tent map is an extended version of 
the normal skew tent map Fa- 



G(a,l3) '■ 




if < x.t^i < 1, 
otherwise, 



where 



a), 



< Xi-i < a, 



< 1. 



a < Xi 



(1) 



(2) 



The secret key was claimed to be a 4-tuple key 
{a, f3,j, K), where 7 is used to generate a secret initial 
condition xq of G(o!,/3) as follows: 

' ioLi°gio *J 



t 



(3) 



Here, t representes the current time-stamp transmitted 
over a public channel. Since 7 is only used to generate 
Xq, the secret key can also be considered as (a, (3, xq, K). 
Based on the secret key, the following secret functions are 
calculated for the encryption/decryption procedures: 
1) A sequence of An-bit noise vectors Uj — 

{u4jn,U4jn+l, ■ ' ' , U4jn+4n-l) {j — 0, 1,2,--- ,) 

are generated from the digital chaotic orbit' of the 
extended tent map G(^a.p) with the following rule: 



0, < a;, < a, 
II, a < Xi < 1. 

2) A sequence of secret permutations 



(4) 



(J 



0, 1, 2, • • • ; i = 1, • • • , n) are generated from 
Uj and the sub-key K, as follows: Vj = 
{vji,Vj2,-" T^jn) = Uj © K, where each Vji 
corresponds to a function Wji that represents a 
permutation of four integers {1,2,3,4} (following 
Table 1 of [1]). 

'In this paper, the term "digital chaotic orbit" is used to denote the orbit 
of a chaotic map realized in a digital computer [2, Chap. 2.5]. 
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3) A sequence of secret bit-permutation functions fj = 
fjn o ■ ■ ■ o fji [j — 0, 1, 2, • ■ • ) are generated as 
follows: 

^ f,,{Mi,M2,M3,M4) 

= [wj,{Mi,M2, Ms, M4)] «< 1, (5) 

where X = Mi x 2^" + M2 x 2^" + M3 x 2" + AU 
and "<?g; 1" is the 1-bit circular left-shift operation. 

4) Another sequence of permutation functions f^^ = 
fj-^ o ■ • • o fjl^^ are generated as follows: 

fJi'iX) = fJ,\Mi,M2,M3,M^) = 

[wJ^^{Mi,M2, M3, M4)] 1, (6) 

where /^^^ is the inverse function of fji, i.e., 
IJl^ iM^)) = and 1" is the 1-bit circular 
right-shift operation. 

• The initialization procedure: C'o ~ Uq, Pq = Ui. 

• The encryption procedure: 

Cj = (P,- © (C,_i ffl C/,+i)) © (P,_i ffl C/j+i) , 

(7) 

where © denotes XOR and a ffl 6 (a + 6) mod 2**". 

• r/ze decryption procedure: 

(8) 

III. Reduction of Key Space 

This section discusses the reduction of the key space of the 
Yi-Tan-Siew cipher, i.e., its first two security defects. 

A. The Differential Chosen-Plaintext Attack for Reducing K 

To break the Yi-Tan-Siew cipher via a chosen-plaintext 
attack, the attacker has to make t fixed during the attack, 
i.e., to make the sub-key xq and the noise vector sequence 
{f/j} fixed. This can be done by intentionally altering the 
local clock of the encryption machine, which is generally 
available since the attacker can access the encryption machine 
in chosen-plaintext attacks [3]. If t is generated from a public 
time service, the attacker can simply altering the time signal 
transmitted over the public channel to alter t. In the following, 
therefore, assume that t is fixed for all chosen plaintexts. 

Assume {Pi,-- - ,Pj_i,Pj} and {Pi,-- - ,P,_i,Pj} are 
two plaintexts. The difference of the ciphertexts is as follows: 

AC, = c,©c;. = /,-i(p,©(c,-ifflc/,+i)) 

©/,_i(p;©(Q_iffl;7,+i)).(9) 

Assume CUj = Cj-i ffl Uj+i. Then, Eq. (|9j is reduced to 

AC, = /,_i (p, © cUj) © /,_i (p; © cu,) . (10) 

Now, consider such a question: what can one observe from 
ACj, if Pj and Pj have only one different bit? Assume that 

Pj = {Pijn, • • • ,PAjn+i, ' ' ' i ?'4jn+(4n- 1) ) i 
Pj = {P4:jm • • ■ ,P4jn+i, ' ' ' 7 P4jri+(4n-l) ) 7 



and CUj — (cuq, - - - , cu4„_i). It is obvious that Pj © CUj 
and Pj © CUj also have only one different bit at the same 
position i. Thus, further assuming that 

Pj © CUj — {P4jm ■ • • ^P4:jn+i^ ' ' ' 7 P4jn+(4n- 1) ) ' 
Pj © CUj — {P4jn, • • • 7?'4jn+i7 " ' ' 7 P4jn+(4„- 1) ) 7 

one has 

— fj-^iPijm ' ' ■ 7P4jn+i7 ' ' ' 7 P4jn+(4n-l) ) 

© fj-iiPijnJ ' ■ ' 7?'4j„+i7 ■ ■ ■ 7P4j„4.(4„-l))- 

Considering /j_i is a bit-permutation function, one 

has /,_i (P, © CUj ) - iP'4jn+I„ . • • • 7 P'ijn+I, = 
P'i3n+^, ■ ■ ■ ,P4jn+I^,l ^nd /j_i (Pj © CUj) 
iP4j7i+Io' " ' ^P'ijn+I, — P4jn+i' " ■ 'P4jn+/4„_i)' whcrC 

Iq ~ /4n-i G {O7 1, • - - 7 4n — 1} denote the permuted 
positions of the 4n bits p'^^j^ ^ P4jri+(4n-i)- ^ result, 

in-l l-l 

ACj = (0~^^7 1,0~^^) = 2'-\ (11) 

which means that the «-th bit of AP = P, © Pj is permuted 
to the Uh bit of AC = Cj © Cj by /j_i. 

From the above discussion, one can immediately conclude 
that given the following (4n+l) plaintexts containing j plain- 
blocks, the secret bit-permutation function /j _i can be exactly 
reconstructed: 

p(,) ^ (P*,--- ,P*,P*), 
P(i) = (P*,--- ,P*,Pi), 

P^'^ - {P*,--- ,P*,Pi), 

P(4") = (P*,--- ,P*,P4„), 

where P* (B Pi = 2'^^. To get all r secret permutation 
functions /o ~ fr-i for the decryption of ciphertexts whose 
sizes are not larger than r, the number of required plaintexts 
is (An + 1) X r. 

Since the sub-key K is used only to determine {fj} 
(together with Uj), the reconstruction of /o ~ /r-i means 
the reduction of K from the whole secret key {a, f3, 7, K). 

Note that it is generally difficult to derive Vj from fj, due to 
the strong mixing of Vji and the bit-shifting operations. That 
is, it is generally difficult to derive K from fj, even when Uj 
is known to the attacker. 

B. The Differential Chosen-Ciphertext Attack for Reducing K 

Due to the similarity of the encryption and decryption 
procedures, the above differential chosen-plaintext attack can 
be easily generalized to a differential chosen-ciphertext attack. 
Here, the attacker can make fixed during the attack by 
altering t transmitted over the public channel, which is pos- 
sible since generally the attacker has a full control of the 
public channel. In the differential chosen-ciphertext attack, 
one can replace the [An + 1) x r chosen plaintexts in the 
above differential chosen-plaintext attack with (4n + 1) x r 
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chosen ciphertexts. As a result, one can get all r inverses 
permutation functions, /q"^ ^ fr-i^ which is equivalent to 
the r permutation functions, /o ^ fr-i- 



C. Reduction of (3 

In Sec. III-B of [1], it was said that "most likely, (3 does 
not act in the encryption and decryption processes", without 
any explanation. Here, we will theoretically verify this claim. 

In the extended tent map Ga,p, P will have to make 
influence on the cipher only after x = or 1. However, 
the possibility that a; = or 1 is so tiny that the impact of 
(3 on the encryption/decryption procedures is computationally 
negligible from the Probabilistic point of view. 

Without loss of generality, assume that the map Ga,fi is 
realized in n-bit computing precision and that the digital 
chaotic orbit distributes uniformly in the discretized space, 
which is reasonable due to the uniform invariant density 
function of the skew tent map [4]. So, the Probability that 
X = or 1 is p = 2/2" l/2"-i. As a result, from flie 
mathematical expectation of the geometric distribution [5], the 
average position of the first occurrence of the above event 
(x = Q or 1) is 1/p = 2"-i. 

For single-precision floating-point arithmetic, n = 30 (two 
sign bits are excluded), averagely 2^^ — 512M iterations 
are needed to activate the influence of (3 on the encryp- 
tion/decryption procedures. This means averagely 2^^/8 = 
64M leading bytes of the ciphertext can be successfully 
decrypted without any knowledge of j3. Similarly, when the 
double-precision floating-point arithmetic (n = 62) is used, the 
condition will become much worse: averagely 2^^/8 = 2GG 
leading cipher-bytes can be decrypted without knowing j3. 

Therefore, in most (if not all) cases, (3 is not meaningful 
in the key. In fact, it is just a trivial parameter (not part of 
the secret key) to avoid the digital chaotic orbit of the normal 
skew tent map Fa to fall into the fixed point a; = 0. 

As a summary, under the above differential chosen-plaintext 
attack, the original key {a, (3,^,K) collapses to be (01,7). 
When the differential chosen-plaintext attack is impossible, 
the original key (a, (3, 7, K) collapses to be (a, 7, K). 

IV. Non-Uniformity of Noise Vector Uj 

In the encryption procedure of the Yi-Tan-Siew cipher, the 
noise vector Uj+i is used to mask the plaintext Pj together 
with the previous plaintext Pj-i and the previous cipher- 
text Cj-i. To enhance the potential capability of resisting 
statistics-based attacks [3], it is desirable that Uj distributes 
uniformly in the discrete space {O, • • • ,2'*" — l}- However, 
as mentioned in Sec. III-B of [1], Uj does not distributes 
uniformly when a is close to or 1. As a suggestion, 0.49 < 
a < 0.5 was suggested in [1]. However, neither theoretical 
nor experimental analysis is given in [1] to support this claim. 

In this section, we investigate the theory underlying the 
non-uniformity of Uj over {0, ••• ,24"-!}. In addition, it 
is pointed out that the non-uniformity of Uj is also very 
significant when a = 0.5, which was not noticed in [1]. 
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Fig. 1. The occurrence frequency of Uj = a £ {0, ■ ■ ■ ,255}, when 
(o,/3,xo) = (0.1,0.7,0.3) (1000 samples). 



A. Non-Uniformity of Uj when a ^ 0.5 

In this subsection, it is shown that when a 0.5, the closer 
the a is to or 1, the more severe the non-uniformity of Uj 
will become. Strictly speaking, a ^ 0.5 can never lead to a 
uniform distribution. 

Similar to Sec. IIII-CI assume again that the digital chaotic 
orbit of the map Ga.p distributes uniformly in the discretized 
space. It is then easy to deduce the following two Probabilities: 



Prob{wj = Q} = a, Prob{'u.j = !} = !-, 



(12) 



The above equations mean that 
bits than 1-bits when a > 0.5 
bits when a < 0.5. That 



Ui will contain more 0- 



is. 



, and more 1-bits than 0- 
Uj does not have a uni- 
form distribution over |0, • • • , 2^" — l} if a 7^ 0.5. When 
(a,/3, xq) = (0.1,0.7,0.3) and n = 2, for example, under 
double-precision floating-point arithmetic. Figure ^ gives an 
experimental curve of the occurrence frequency of Uj with 
different values between and 2*" - 1 = 2^ - 1 = 255. It 
can be seen that the frequency of Uj = 255 = (11111111)2 
is close to 0.5 but many others are almost 0. 

Under the assumption that all bits in Uj are independent 
each other, Va G {0, • • • , 2^" — 1}, one can theoretically de- 
duce flie Probability of Uj = a: Prob{C/,- = a} = a^o(°)(l - 
^■^4n-Noia)^ whcrc No{a) e {0, • • • , An} denotes the number 
of 0-bits in a. In total there are (4n + 1) different values in 
all 2*" Probabilities: Prob(O) = a^", Prob(l) = a'*"(l - a), 

• • • , Prob(i) = a'*"-''(l - a)\ • • • , Prob(4?i) = (1 - a)^". 

The non-uniformity of each Uj is useful for an attacker 
to get its value more quickly via a specially-designed guess 
order. Since the secret bit-permutation functions {/j-i} can be 
reconstructed under chosen-plaintext attack (recall Sec. IIII-At . 
the attacker can successfully decrypt any ciphertext once {Uj} 
are obtained. That is, ({tj}, {/j}) can be considered as an 
equivalent of the original secret key (a, /3, 7, K). 

To find the right value of each Uj, the following guess order 
of Uj = a is suggested: Va G A^yjAin, • • • , Va S AiUAin-i, 

• ■ • , Va e A2n, where Ai (i = ~ 2n) denotes the set of all 
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Com{a) 



' ( Prob(i) • ( H{i) + + Prob(4n - i) ■ (h{i) + ('^'^^ + J^^^-^^ m 



^rn—O 



+ Prob(2n) • i/(2n) + S^^''"' 

■5-^2n-l / ■ 

22 ._p (Prob(i) + Prob(4n - i)) ■ lH{i 
+ Prob(2n) • ( i7(2n) + l£)ii£l±l) ) 



(t) ((^"^ 



Prob(4n — i) 



4n 



(13) 
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4n-bit binary integers that contain i 0-bits. With such a guess 
order, the average number of searched integers (i.e., the guess 
complexity) Com{a) can be calculated with Eq. (I13> . where 
H{i) denotes the number of previous searched integers: 



1=0 



/ in 



(=0 



(14) 



(=0 

When n — 16, for instance, the relationship between the 
calculated complexity and the value of a is shown in Fig. 
121 Note that there exist calculation errors^ that make each 
log2(Com(a)) a little less than the real value, but this fact 
does not influence the following qualitative analysis. From 
the experimental data given in Fig. |2] one can see that the 
complexity is much less than 2"*"^^ = 2^^ (the complexity of 
the brute-force guess of a uniformly-distributed 4n-bit integer) 
when a is close to or 1 . Apparently, the closer the a is to 
or 1, the weaker the sub-key a will be. As a result, to ensure 
the security of the Yi-Tan-Siew cipher, the sub-key a has to be 
constrained in [ao, 1 — uq] C (0, 1), where Com{ao) should 
be cryptographically large. This, however, will further reduce 
the key space to some extent. 

In [1], 0.49 < a < 0.5 is suggested to avoid this security 
defect. In this case, 1-bit will always occur with a higher 

^The errors are natural results of the unavoidable accumulation of the 
intermediate quantization eiTors. 



Probability than 0-bit, since Probjui = 1} = 1 — a > 
Prob{Mi = 0} = a. So, one can guess the value of each 
Uj with a different order: ■ ■ ■ A^^- Although 

Prob{wj 1} - Prob{M, = 0} = 1 - 2q! e (0, 0.02) is not so 
much, the guess complexity will still be less than the simple 
brute-force search. From such a point of view, 0.49 < a < 0.5 
should be replaced by its balanced version: \a — 0.5| < 0.01. 

B. Non-Uniformity of Uj when a — 0.5 

From the discussion given above, a = 0.5 seems to be 
the best parameter to generate uniformly distributed {Uj} 
that should maximize the value of Com{a). Unfortunately, 
according to our previous studies on the digital dynamics of 
piecewise-linear chaotic maps (PWLCM) realized in fixed- 
point arithmetic [2, Chap. 3], a = 0.5 is the worst parameter 
from the viewpoint of dynamical degradation occurring in the 
discretized space, which destroys the uniform distribution of 
the generated pseudo-random numbers. 

Actually, as a special case of the digital PWLCM, the 
digital chaotic orbit of G'0.5,/3 can be theoretically analyzed, 
which is similar to but a little more complex than the orbit 
of -Fb.5. Without loss of generality, assume that the least 
significant bit of xq is the nxg-th bit after the dot, i.e., 
.To ~ {0-0,10,2 ■■■ an-,g)2, wherc a„^^ — 1. To facilitate the 
following discussion, nx„ is called the binary precision of xq. 
Substituting a — 0.5 into the equation of Fo,^, one can get 



F0.5 ■ Xi = 



2 • Xi-i, < Xi^i < 0.5, 

2-(l-a;j_i), 0.5 < Xj^i < 1. 



(15) 



It is obvious 



(o.a;4 



that Ff)^{xo) must 
_iO)2, wherea' _i = 



be in the form of 
1. This means that the 



binary precision of xq is decreased by 1 after one iteration. 
Thus, the digital chaotic orbit of Fq,^ will always trend to the 
same fixed point a; = after n^g iterations. 

For Go.5,/3, the introduction of /3 makes things a little 
complicated: assuming that the binary precision of /3 is n/3, 
the orbit of Go.5,/3 will be in the following form: 



7i^g iterations 

Xq > 



iterations 

p > ^ p • 



0^ (3 



Iterations 



-^0^/3- 



That is, the digital chaotic orbit of Gq.s./j enters a periodic 
cycle determined by j3 after a transient stage determined by 
Xq. The period of the final cycle is np + 1. 
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Fig. 3. The digital chaotic orbit of Go. 5, 0.4 when xq = 0.123. 



As an example, when xq ~ 0.123, the digital chaotic orbit 
of Go. 5, 0.4 is shown in Fig. |3] Apparently, such a degraded 
chaotic orbit will generate badly non-uniform {JX,}. When 
71 = 2, experiments show that the frequency of \Jj = 170 
is about 0.993, which means that the non-uniformity is even 
worse than the one given in Fig.^ One more example is also 
tested by changing the value of a in Fig.[2from 0.1 to 0.5 (but 
the values of /? and xq are kept unchanged), and it is found 
that the distribution of IJj has two prominent peaks at Uj = 85 
and 170 (the frequencies are 0.412 and 0.418), respectively. 

The above analysis shows that a — 0.5 is also a rather 
bad parameter for the generation of \lJj\ toward a uniform 
distribution. So, 0.5 should be excluded from the range of a. 
For example, the range \ol — 0.5| < 0.01 should be replaced 
by < |a-0.5| < 0.01. 



C. How to Mend This Defect? 

Since the non-uniformity of {Uj} is mainly caused by the 
fact that Probjui — 0} ^ Prob{wi = 1}, it is easy to mend 
it by changing Eq. Q to the following one: 



0, < < 0.5, 

1, 0.5<a;, <1. 



(16) 



It has been pointed out that dynamical degradation of Go.5,/3 
in the digital domain will influence the uniformity of {Uj}. 
In fact, this Problem also exists for any a ^ 0.5, which has 
been clarified in [2, Sec. 2.5.1]. Following previous studies, the 
average length of all digital orbit of the tent map is 0(2^/^), 
when L is the bit number of the employed finite-precision 
arithmetic. For double-finite floating-point arithmetic, L = 62, 
so the average length is about 2"^^, which is not sufficiently 
large from the cryptographical point of view. To overcome 
this Problem and also the non-uniformity caused by the 
digital dynamical degradation, a small pseudo-random signal 
is suggested to be used to perturb the digital chaotic orbit 
timely, as discussed in Sees. 2.5.2 and 3.4.1 of [2]. 



V. Incapability of Chaos for Security 

In Sec. IIV-AI above, it was mentioned that {{Uj}, {fj}) is 
an equivalent of the original key. By studying the possibility 
of solving for {Uj} from chosen plaintext-ciphertext pairs, it 
can be shown that the security of the Yi-Tan-Siew cipher is 
independent of the use of the chaotic map Ga,i3- 

Given a plaintext Pj and the corresponding ciphertext Cj, 
one can get Eq. for Uj+i. Under the condition that 
has been reconstructed, it is possible to solve for tj+i with a 
number of such equations. Apparently, the solvability of Uj+i 
is independent of the chaotic map Ga,i3- That is, the security of 
the cipher is independent of Ga,i3- In fact, one can replace the 
chaotic map with any other PRNG to generate Uj, without 
influencing the security of the cipher. Therefore, from this 
point of view, the Yi-Tan-Siew cipher cannot be considered as 
a typical chaotic cipher 

Next, the solvability of Eq. Q is discussed. Basically, 
the mixture of three different operations, XOR, modulo 2"*" 
addition, and fj-i, makes it rather difficult to get Uj+i from 
Eq. (0. Rewrite Eq. (0 as follows: 

Cj © ffl Uj+i) = (Pj © (Q^i ffl U,+i)) , (17) 



which can be simplified as 



la;) = /j_i(c© (dffla;)). 



(18) 



The task is to find a 4n-bit integer solution of x from a 
number of such equations. Considering that contains n 
circular left-shift operations, it should have at least 2" separate 
branches. This implies that at least 2" points of intersection 
between the graph of a © (6 ffl a;) and that of /j_ 1 (c © (d ffl a;) ) 
have to be checked to find the only right integer solution of 
X. That is, a lower bound of the complexity is 0(2"). 

VI. Conclusion 

This paper has studied the security of the recently-proposed 
Yi-Tan-Siew chaotic cipher [1]. Some defects of this cipher 
have been pointed out and analyzed in detail. The security 
analyses given in this paper should provide some useful 
references for better design of various chaotic ciphers in the 
future. 
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